apalrd's adventures
apalrd's adventures
  • 116
  • 6 306 250
SELF-HOSTING behind CGNAT for fun and IPv6 transition
This video started as the answer to a simple question - how can I self-host a service for my friends and family, behind cgnat, without requiring them to install any apps (like tunnels)? This video turned into a bunch of different ways to proxy IPv4 to IPv6, so you can receive IPv6 traffic natively and bring in legacy traffic from a VPS which does have public IPv4.
I cover several different methods:
- Using IPv6 only
- Using Cloudflare Tunnels
- Using SNID (sni daemon) - github.com/AGWA/snid
- Using HAProxy to forward TCP and TLS traffic
- Using Tayga to port-forward from IPv4 to IPv6
- Using Wireguard along with port-forwarding and NAT across the tunnel
The installation instructions for snid, haproxy, tayga, and wireguard are all in my blog post, along with a comparison table:
www.apalrd.net/posts/2024/network_relay/
You are also welcome to try my asciimation server: telnet vpn-hel2.apalrd.net
Support me on Ko-Fi if you enjoy my content and find it useful:
ko-fi.com/apalrd
Feel free to chat about my upcoming projects on Discord!
discord.gg/xJsaEukAr4
Timestamps:
00:00 - Introduction
00:43 - Goals
03:36 - Use IPv6 Only
06:00 - Cloudflare Tunnels
09:02 - SNID
16:50 - HAProxy
20:53 - Tayga
27:52 - Wireguard
33:35 - Bonus!
#networking #ipv6 #homelab #selfhosted
zhlédnutí: 10 908

Video

ALL ABOUT VPNs in OPNsense! Wireguard, OpenVPN, and IPSec Setup and Configuration
zhlédnutí 7KPřed 21 dnem
In this very long video, I cover all the basics of VPN technologies (not the youtube shill type), how tunnels work, and the different topologies that are used in modern networks. Then I setup several examples for each of them using different protocols and methods. Hopefully you find it useful in your own network! Support me on Ko-Fi if you enjoy my content and find it useful: ko-fi.com/apalrd F...
Tracking my CAT with AI! Feat. Object Detection in Frigate and Viseron NVR
zhlédnutí 5KPřed měsícem
Today I try to use AI Object Recognition with a high resolution security camera to track my cat in the yard. Unfortunately he's a very stealthy cat with beautiful camouflaged fur , but I did see some other cool animals. Sponsored by Reolink and the Duo 3 PoE! reolink.com/us/product/reolink-duo-3-poe/?aff=329 Support me on Ko-Fi if you enjoy my content and find it useful: ko-fi.com/apalrd Feel f...
Using a LASER CUTTER with my VEX Robotics Students
zhlédnutí 2KPřed měsícem
Creality wanted to send me their Falcon2 Pro Laser Cutter, and I know just the people to help me test it, my robotics students! Join me as we try to cut different materials, engrave on wood and laser-safe vinyl, and overall improve our CAD abilities one student at a time. Buy a Crealiity Falcon2 Pro (Use my code FL22WH for 15% off): DTC store: bit.ly/3vORflv US Store: bit.ly/3UmXFS5 Facebook Gr...
A Software Disappointment: Kwumsy H3 Stream Dock
zhlédnutí 3,1KPřed měsícem
The Stream Dock: kwumsy.com/products/kwumsy-h3-8-in-1-visual-macro-keyboard-hub?ref=EeoX5XElS_V68N So today I'm taking a look at the Kwumsy H3 'Stream Dock' No, not THAT Stream Deck, not a dock for the Steam Deck, there's already enough name confusion. Basically, it tries to be a lower cost touchscreen alternative to the real Stream Deck, making use of the same addon format for wide addon suppo...
Saving Power in my Homelab with Auto-Shutdown for Proxmox Backup Server
zhlédnutí 24KPřed měsícem
Today I'm trying to reduce the power consumption of my [Proxmox Backup Server](/posts/2023/pbs_intro/). The HP Microserver is great for what I need, but it's kinda loud and I'm working on optimizing my power bill. The homelab is the largest single consumer of electricity aside from the air conditioning in the summer, so it's something I'm looking at heavily. I tried doing S3 speep (normal suspe...
A NEW PLAYER enters the NAS Market: Hardware Teardown and More
zhlédnutí 16KPřed 2 měsíci
Today I'm tearing down the UGreen DXP4800 Plus, as UGreen tries to enter the NAS market. Will the hardware and software be enough to compete with established players? Stay tuned to find out. Links to the UGreen NASync Family: Ugreen NASync DXP4800 Plus: kck.st/3TKOdYB 3/28-5/9: Up to 35% OFF during 3/28-5/9 I do a deep-dive into the hardware, build quality, overview of the included software, an...
Do you need LoRa for LONG RANGE Sensor Networks? Locally-Hosted Setup w/ Chirpstack
zhlédnutí 10KPřed 2 měsíci
Do you like sensors and data collection as much as me, but need a solution for longer range than you can get with WiFi, Zigbee, Z-Wave, etc? Maybe you should take a look at LoRa, and the LoRaWAN network topology. In this video, I walk through what LoRa and LoRaWAN are, how you can setup a LoRaWAN gateway and self-hosted Chirpstack cloud for your own home network, and eventually get sensor data ...
Proxmox SOFTWARE DEFINED NETWORKING: Zones, VNets, and VLANs
zhlédnutí 35KPřed 2 měsíci
I made a Proxmox VLANs, Bridges, and Bonds tutorial awhile ago, but since then, the Software Defined Networking module has come out of tech preview! So it's time to take a look at it! With SDN, you can manage your Proxmox VNets and VNet Zones cluster-wide, and enforce permissions on users who can configure VNets for VM and Container resources. While the SDN has additional functionality for mana...
Use your LAPTOP as a KVM! The Pi-Cast USB KVM
zhlédnutí 24KPřed 2 měsíci
Today, I take a look at the Pi-Cast KVM, a PiKVM compatible system which lets you use your laptop as the keyboard/display/mouse when working with PCs and servers. Based on the Raspberry Pi Compute Module 4, the Pi-Cast features USB3 gigabit Ethernet between the Pi-Cast and your laptop, HDMI input, USB gadget emulation, and a number of accessory hats are available to add ATX power control and a ...
Going IPv6-Mostly with Tayga NAT64 on OPNsense
zhlédnutí 8KPřed 2 měsíci
Today I'm going to expand on my previous IPv6-only experiments and try to move to an IPv6-mostly network, a few devices at a time. But for this to work well, I need to give my IPv6-only clients access to the IPv4 internet, via NAT64. So join me as I setup Tayga to provide NAT64 functionality on OPNsense! And once I have NAT64 setup, I can start to migrate clients entirely away from legacy netwo...
New Boot SSD for my PROXMOX System
zhlédnutí 19KPřed 3 měsíci
Today I'm replacing the old SATA boot drive in my Proxmox system with an NVMe drive. I walk through a bit about NVMe, DRAM caches, and Host Memory Buffer, test the new SSD, and finally setup the partition table, boot partitions, and copy my root filesystem onto the new SSD. The SSD: amzn.to/4bLKSj4 fikwot.net/discount/VMHYP s.click.aliexpress.com/e/_olb7UkC Support me on Ko-Fi if you enjoy my c...
Ultimate S-Tier Wifi Security with EAP-TLS Certificates (feat. Smallstep)
zhlédnutí 8KPřed 4 měsíci
So in a previous video I talked about the different types of WiFi security, and concluded that WPA-Enterprise is the ULTIMATE! So today we're going to implement that, using a Unifi WiFi setup and Smallstep's new certificate authority as an example. Smallstep has the written instructions on their blog (thx Carl): smallstep.com/blog/home-network-eap-tls-wifi/ Support me on Ko-Fi if you enjoy my c...
Secure Your OPNsense Network with Zenarmor NGFW!
zhlédnutí 21KPřed 4 měsíci
Secure Your OPNsense Network with Zenarmor NGFW!
How Secure is YOUR WiFi Network?
zhlédnutí 14KPřed 4 měsíci
How Secure is YOUR WiFi Network?
UniFi, Get your (IPv6) act together!
zhlédnutí 12KPřed 4 měsíci
UniFi, Get your (IPv6) act together!
Does your Desk need a TOUCHSCREEN + Keyboard? The Kwumsy K3
zhlédnutí 6KPřed 5 měsíci
Does your Desk need a TOUCHSCREEN Keyboard? The Kwumsy K3
All About SUBNETTING your Networks! IPv6, IPv4, and VLAN Numbering Guide and OPNsense Demo
zhlédnutí 15KPřed 5 měsíci
All About SUBNETTING your Networks! IPv6, IPv4, and VLAN Numbering Guide and OPNsense Demo
Unleash your Home Cameras with FRIGATE Self-Hosted AI Video Recorder! Install on Proxmox LXC
zhlédnutí 34KPřed 6 měsíci
Unleash your Home Cameras with FRIGATE Self-Hosted AI Video Recorder! Install on Proxmox LXC
Building a TELEPROMPTER with a Raspberry Pi
zhlédnutí 2,8KPřed 6 měsíci
Building a TELEPROMPTER with a Raspberry Pi
A $9 Introduction to the RISC-V Future of Computing
zhlédnutí 336KPřed 7 měsíci
A $9 Introduction to the RISC-V Future of Computing
Add a DAS to your NAS! USB Direct Attach Storage with ZFS
zhlédnutí 37KPřed 7 měsíci
Add a DAS to your NAS! USB Direct Attach Storage with ZFS
Migrating my PERSONAL SERVER from TrueNAS to Proxmox + Cockpit
zhlédnutí 32KPřed 8 měsíci
Migrating my PERSONAL SERVER from TrueNAS to Proxmox Cockpit
Gitea: Easy Self-Hosted Git Repositories!
zhlédnutí 24KPřed 8 měsíci
Gitea: Easy Self-Hosted Git Repositories!
HOW TO SETUP OPNsense: From First Boot to Fully Functional (with IPv6!)
zhlédnutí 65KPřed 9 měsíci
HOW TO SETUP OPNsense: From First Boot to Fully Functional (with IPv6!)
Should I use TAPE BACKUP in 2023? LTO-5 Drive with Proxmox Backup Server
zhlédnutí 49KPřed 9 měsíci
Should I use TAPE BACKUP in 2023? LTO-5 Drive with Proxmox Backup Server
Updating my WORKSTATION! F in the Chat for my Threadripper :(
zhlédnutí 6KPřed 10 měsíci
Updating my WORKSTATION! F in the Chat for my Threadripper :(
MOVING My Website from Static Hosting to Caddy!
zhlédnutí 11KPřed 10 měsíci
MOVING My Website from Static Hosting to Caddy!
Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition)
zhlédnutí 13KPřed 10 měsíci
Layer 4 vs Layer 7 Reverse Proxies: Using HAProxy to front Web Services (for IPv4 to v6 Transition)
The Power of Zero-Trust Architecture: Building a Secure Internal Network with Nebula
zhlédnutí 17KPřed 10 měsíci
The Power of Zero-Trust Architecture: Building a Secure Internal Network with Nebula

Komentáře

  • @The1Corrupted
    @The1Corrupted Před 13 hodinami

    It was this week I decided to just setup V6 and get it to work completely "just because". Literally everyone in my group has tried to talk me out of it because "Network issues? Disable V6." There is a huge knowledge gap. SLAAC will not work all the time and I believe they are confusing internet issues when they should be just managing their IPv6 network with router advertising.

  • @ohokcool
    @ohokcool Před dnem

    Great update to your other vid, I realized after watching that it’s perfect for the use case you outlined but that it only worked one way. I think I’ll go for a 3rd “witness” node for the quorum.

  • @fabioh1590
    @fabioh1590 Před dnem

    Great video, very detailed and super specific, thanks a lot mister.

  • @FourCorners-im3jg
    @FourCorners-im3jg Před dnem

    Okay, unrelated question. What browser are you using in the video? It doesn't look familiar and I couldn't find anything like it.

  • @mirko1989
    @mirko1989 Před dnem

    leave it on a screen for a second FFS !!! how can we follow without seeing the graphic , your mug is absoultely irrelevant to us !

  • @wesselrosheuvel7086

    Wow this is quality

  • @bokami3445
    @bokami3445 Před 2 dny

    Just wanted to say Thanks for this video. Using the information you present, I managed to get JellyFin HW decoding working on my Proxmox cluster.

  • @M9OCD
    @M9OCD Před 2 dny

    Great video and well explained dude! I've got all the nodes pinging over the ring network, so well happy but how do we get ceph to use them in proxmox given we can't run dual stack, and the ring network is not seen in the GUI? (next vid?)

  • @drivetrainerYT
    @drivetrainerYT Před 2 dny

    besides this video, thank you for the RSS on your site, much appreciated

  • @RManPT
    @RManPT Před 3 dny

    Would this still work on rpi5 with bookworm? Is it ok to have the X server although bookworm works on Wayland? I have a perfectly working setup based on this post and am wondering if updating the previous version of raspberry os to bookworm would allow me to just take the SD and run it on rpi5. Any thoughts? Ty

  • @davidreddick3016
    @davidreddick3016 Před 3 dny

    I actually own one of these and used it a few times in the early 2000s. Even at USB 2 speeds it was faster than the 100 mb ethernet port many devices had.

  • @3urobeat2
    @3urobeat2 Před 3 dny

    This was an insanely good video! I’m really happy that I just stumbled over this. Subscribed!

  • @yevhenbryukhov
    @yevhenbryukhov Před 4 dny

    White theme is a big misconfiguration 😜😄

  • @RootServerAdministrator

    I used to use wireguard but switched to ocserv.

  • @swiftlabbuildstuff
    @swiftlabbuildstuff Před 4 dny

    I found this video excellent. I usually learn by example but I was hesitant to give the "ring network" a try since all the examples I found were 3 node ring networks. This video gave me the confidence that I could make this work with a 5 node node Proxmox cluster. I already have dual 10g LACP bond physical switched networking per node, which is plenty fast. After configuring the dual Thunderbolt on each node in a ring, I found it pretty easy. Even with a node (and its links) down, any other node is no more than a few hops away. Maybe still faster than the 10g LACP bond. Need to test though. I love that you show how to run the iperf, traceroute and nload commands for checking the connectivity. Very easy to follow. My next challenge is that this Proxmox cluster already hosts a Ceph cluster using IPv4 addressing on the 10g bond, but now I want to move the Ceph backend network over to the ring network. From what I can find, Ceph can't run dual stack - needs to be all ipv4 or ipv6. I'll be looking forward to your blog post/video on Proxmox Ceph running on the ring network. Once again, thanks for an excellent video!

  • @bjarnenilsson80
    @bjarnenilsson80 Před 4 dny

    Not to mention protocols emeding ip addresses in higher level headers (see SIP et all) not having to deal with algs and TURN/STUN on ipv6 will be mice onece ipv4 turns into a small minority. On the subject of IPv and containers (docker in my case), is it possible to set things up so that the contaners get IPv6 adresses via autoconfiguration (router solicitation + router advertisement) this can pe rather handy in a hom lab cenario when you isp depsides to give yo a different PD (which for home internet can, depending on ISP; be rather frequently) it would be nice not to have to change ipv6 addresses for numerous containers manually, and not evryone hase orcestartion rolled out,. It might just be me being an idiot but i can't seeam to get it to work

  • @tsclly2377
    @tsclly2377 Před 5 dny

    Better for machine control, because it doesn't have to do calculations, more or less dealing with libraries and no floating point needed.. that can be off loaded to the 'master'. Speed can matter and 2 core, if programed right gives a back-up redundancy in critical implementation.. a worker and a guard that can pickup the worker's implementation and flag operation, but still get communication and operational results if a core freezes. Code smart and know your core kernel functions. I wish that they would do some of the micro controllers in dual core and 16 bit..

  • @it-linux-computers-geeky6651

    If your looking for a free version don't waste your time with this as everything is locked behind premium subscription so it's practically useless unless you subscribe

  • @rafaelbagattini
    @rafaelbagattini Před 5 dny

    Incredible! Congrats for the content!

  • @SupremeMortal
    @SupremeMortal Před 6 dny

    I have a VPS with a GRE tunnel to the IPv6 address of my home router, then enable ip_forward and set the next hop of the IPv4 address of the VPS to my router through the GRE tunnel. The advantages of this is less overhead so you can host it on a dirt cheap VPS, and it's even possible to assign the public IP directly to a server on your LAN if you use a GRETAP tunnel. All of this is configured without installing any extra software on the VPS since it only uses the "ip" command in Linux.

    • @apalrdsadventures
      @apalrdsadventures Před 6 dny

      I did setup a prototype with IPIP (GIF on BSD) and found that OPNsense wasn't properly configuring GIF for IPv4 in IPv6 (it's normally used for the opposite, IPv6 in IPv4 for Hurricane Electric).

  • @derderkommentierte741

    What is the gateway IPv6 adress in your example? 32:33

    • @apalrdsadventures
      @apalrdsadventures Před 6 dny

      Same as with v4, our own address off by 1. Gateway field is normally used to resolve the MAC address of the next hop, but since Wireguard is a purely layer 3 protocol, there is no MAC. So we really just need *something*.

  • @Mr.Leeroy
    @Mr.Leeroy Před 6 dny

    Now, how's this for a joke. My ISP has IPv6 by default, but.. If I rent IPv4, they cut off my IPv6 access. And the most hilarious thing is their excuse saying that if a client requests IPv4 address, there is a need to use it as a static IP for auth reasons in 3rd party services and if they were to leave IPv6 access routers would prefer v6 over dedicated v4 and the whole auth thing would fail. So they a preferring to break transport so that some Chad renting IPv4 for auth reasons would not bother their dysfunctional support.

  • @Justfillintheblank
    @Justfillintheblank Před 7 dny

    Very interesting concept. I never would have even thought of doing it this way. I want to add my 2c for 7:36: UTP just means unsheilded twisted pair, what most ethernet cables are by default. STP (shielded twisted pair) is better if you want to run the cable through plenum, since they have shielding against EMR. A bit pedantic, but you seemed confused about it haha. Source: I'm a JR. network engineer.

  • @rmkkmrrmk
    @rmkkmrrmk Před 8 dny

    Thank you so much, this is exactly what I was looking for, direct to the point, no unnecessary explanations, very clear and precise. Works like charm.

  • @DAVIDGREGORYKERR
    @DAVIDGREGORYKERR Před 8 dny

    I you can get large diameter hose on a 1KM Reel then you could use that as a conduit and just cut it to the required length just make sure it is buried 6 feet below the surface of your lawn as you don't want your fibre optical cables getting cut by the lawn-more or by nasty pieces of work who don't like you having broadband.

    • @apalrdsadventures
      @apalrdsadventures Před 8 dny

      I am not sure you appreciate how hard it is to trench 6 feet deep in a lawn

    • @DAVIDGREGORYKERR
      @DAVIDGREGORYKERR Před 8 dny

      @@apalrdsadventures We had to dig a trench to pour concrete into in order to build a wall at my old address near Ahoghill.

  • @armisis
    @armisis Před 8 dny

    I have a 9 cluster raspberry pi 5 and 4 proxmox setup now, just seeing the best way I can serve it out as a vdi cluster through a website to allow login sessions to different vdi vm's, am looking at trying to serve out chromiumOS/chromeOS out as a vdi session to zero clients or again through a web site in my house.

  • @thecrazymouse7220
    @thecrazymouse7220 Před 9 dny

    Has anyone used the setup, but instead of using a workable desktop, when they sign in this will automatically start up a specific app? Like running them in a kiosk? What about local printers attached (USB). Look at some ways to make this like a THIN CLIENT to run an Azure Remote Desktop software (session)

  • @NanoNanoHi
    @NanoNanoHi Před 9 dny

    destiny

  • @mbvalency
    @mbvalency Před 9 dny

    why don't you have a home (box) for your computer? (I have a ton of them by the way ;))

  • @trimfly
    @trimfly Před 9 dny

    have you tried to replace pcie-sata with smth else? it could be 6- or 8-bay nas with other relatively cheap adapter. i am curious if it will be supported in the UI.

    • @apalrdsadventures
      @apalrdsadventures Před 9 dny

      I have no idea, but they make 6 and 8 bay versions if you want to just get that instead.

    • @trimfly
      @trimfly Před 9 dny

      @@apalrdsadventures i've already backed for 4-bay version and now waiting for delivery). 200$ gap between 4 and 6 is too big even with current discount. without discount it is even more. i just was curious if it is possible at all. +2 disks for 40$ adapter sounds intriguing for me)

  • @varno
    @varno Před 9 dny

    Run 464 xlat, basically a private cgnat, but you control the exit port, so you can control the port forwarding. You can use this to derive your own IPv4 exit. You can use jool to implement this see siit-dc-xlat. You can then port forward on your virtual private server gateway.

    • @apalrdsadventures
      @apalrdsadventures Před 9 dny

      Jool is kinda a pain to work with because of how traffic bypasses a lot of the normal linux Netfilter, and doesn't work for translating packets from the local system.

    • @varno
      @varno Před 9 dny

      @apalrdsadventures there is also cgnatd that can do the local traffic. But you can implement it on a router or in VMs too. The big thing is it gives you a non cgnat ipv4 tunnel over ipv6.

  • @elalemanpaisa
    @elalemanpaisa Před 10 dny

    IPv6 😢 I was so smart and left to latam and had my homelab server running behind my firewall in Germany. There it's a ds lite so same problem as you are describing here.. but in latam we have our own IPv4 but no IPv6.. it was a pain in the ass.. if anyone cares how I solved that let me know

  • @-felt
    @-felt Před 10 dny

    Im in australia, and neither my mobile isp nor my home isp assign me an ipv6 address. with the exception of my isp when i was opted in to their bullshit gcnat. Is it just better in that case for me to continue using ipv4 since i have absolutely no exposure to ipv6 regardless of where i am and what device im using?

    • @isithardtobevegan53
      @isithardtobevegan53 Před 9 dny

      If you want to have IPv6 you can use a VPN that offers IPv6

    • @-felt
      @-felt Před 9 dny

      @@isithardtobevegan53 i think youre entirely missing the point. The devices have an ipv6 assigned by the router and can be addressed or spoken to directly from the internet using just the ipv6. Using a vpn just adds unnecessary tunneling just as cgnat does, and requires all other uses to be using that vpn. You then run into the trouble of having to separate local and internet traffic, and even further, what parts of the local network a device should still have access to, which yes can still be done with a vpn, is extremely limited and not as flexible. All thats to say, the vpn would just be doing ipv6>ipv4 conversion for absolutely all traffic, so at that stage youre just ipv4 with a gucci belt anyway.

    • @isithardtobevegan53
      @isithardtobevegan53 Před 8 dny

      @@-felt I did not say that this method of obtaining a global IPv6 address is better than as if your ISP gave you IPv6. Of course it would be better if your ISP gave it to you but, getting it from a VPN is at least better than nothing.

  • @madman432000
    @madman432000 Před 10 dny

    What isp's use ipv6, none I've used have.

  • @thechubbypanda
    @thechubbypanda Před 10 dny

    I used Wireguard in the end whem I ended up behind CGNAT. I get IPv6 but it's a dynamic /56. I dont know if/when it'll change :(

    • @apalrdsadventures
      @apalrdsadventures Před 10 dny

      Does the dynamic /56 actually change though? Or is it effectively static?

  • @user-mo8hc6pp1v
    @user-mo8hc6pp1v Před 10 dny

    I (kind of) use the Wireguard method but instead of allowing the VPS acces to my whole local subnet I set up tunnels on every server and configure the port forwarding with nginx (stream directive) since I always had problems with iptables. Failover (or load balancing) come as a nice bonus, and I can use both tcp and udp, and if I ever have to route to a website, I can set up a normal http/s proxy with caching which will also allow for easier certificate management and the ability keep the incoming ip addresses in x-real-ip parameter. The configuration is not that big of a deal to do manually once a month but I may make some webui to automatically rebuild the configuration at some point.

  • @anand-nb4bb
    @anand-nb4bb Před 11 dny

    Hi Bro, Need your help. I have openvpn server with split tunnel configured on pfsense & use this VPN to connect to my work environment Currently I have a Ubuntu 18.04 laptop on which VPN client is configured, after connecting from this VPN, the internet on this system gets disconnected but I can connect to remote system I want internet to be working on my base system as well. There are a few paramenters in the confg file given below route-nopull route 192.168.10.62 255.255.255.255 Can you please help me step by step how to fix this. Kindly help. Thanks & regards,

  • @Voigt_Analytics
    @Voigt_Analytics Před 11 dny

    Great video! Can you help me with my OPNsense / FreeBDS driver problem? I'm using a Sophos XG 125w firewall with OPNsense. But I can't get the Wifi interface working because of missing drivers; vendor = 'Qualcomm Atheros'; device = 'QCA986x/988x 802.11ac Wireless Network Adapter'

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      In general FreeBSD / OPNsense does not have a lot of functional network drivers. I wouldn't expect to get it working.

  • @fbifido2
    @fbifido2 Před 11 dny

    @15:46 - what other address could you used for "IPv6 Prefix" instead of 64:ff9b::/96

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      64:ff9b::/32 is reserved for this purpose. Any /96 will work, even one from your ISP prefix. (OPNsense does not auto-fill the delegated prefix in this case, you have to type in something statically). Technically the prefix can be a few different lengths but practically most software only supports /96. There are different opinions on using 64:ff9b vs a 2xxx prefix. Per the RFCs you cannot use 64:ff9b and also provide access to RFC1918 space, and Tayga will enforce that in code, but no other NAT64 solution is so picky as far as I know.

    • @fbifido2
      @fbifido2 Před 11 dny

      @@apalrdsadventures so, at this point in time, a fully IPv6 only network or domain is not possible? 1. I was hoping for a fully IPv6 only Windows domain/network, with the option for IPv6-to-IPv4 bet at the firewall only.

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      A v6-only Windows domain should be perfectly fine, it shoudn't need to deal with v4 for anything internal. You might have issues with non-Microsoft software not properly supporting v6 sockets with NAT64/DNS64 (Steam used to be the poster child for this problem, but they recently fixed this issue). The only issue with using 64:ff9b::/96 with Tayga is that it won't translate private IPv4 addresses, but that doesn't matter if everything in your domain supports v6-only.

  • @eDoc2020
    @eDoc2020 Před 11 dny

    You can also use SSH port forwarding for port forwarding. A benefit is that it requires no special configuration on the public server. Just write a service on your origin server that SSHs into the public server and everything will just work even if your home network changes. Many of the solutions in your video break if your home prefix changes.

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      This is a good solution for SSH or other low bandwidth protocols, but not a good solution for generic hosting due to the head-of-line blocking problem when multiplexing multiple TCP streams over a single TCP socket (the SSH session).

  • @fbifido2
    @fbifido2 Před 11 dny

    Keeps us posted on your IPv6 only network !!!!

  • @killer2600
    @killer2600 Před 11 dny

    12:30 Octet is 8, colon separation in ipv6 is every 16 bits so it’s a Hextet.

  • @elalemanpaisa
    @elalemanpaisa Před 11 dny

    Now we need a local mirror which is used in the base image that we don't pull all over wan everytime we start the machine. However it is amazing as we can guarantee to have everything up to date

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      Alpine's wiki has a guide on this, and they provide public rsync servers to make it easier on you. Or you could use nginx as a caching proxy.

    • @elalemanpaisa
      @elalemanpaisa Před 11 dny

      @@apalrdsadventures I use squid for caching :) but I commented before I saw you mentioned it and forgot to delete. Probably the quick and dirty would be squid with 7 days retention or similar. Squid is transparent and isn't just limited to that so I guess I would recommend that here and just set an http proxy and probably even run it on your pxe boot vm

  • @mitchhoneysett7674
    @mitchhoneysett7674 Před 12 dny

    What is your network drawing program

  • @elalemanpaisa
    @elalemanpaisa Před 12 dny

    Can you tell something about memory consumption? Would be awesome to hsve a decent experience on a pi zero ,2 w

  • @nicejs8194
    @nicejs8194 Před 12 dny

    by the way, on cloudflare if you only add a AAAA record (with "orange cloud" enabled), cloudflare automatically proxies ipv4 connections if you don't add an A record also I didn't have to provide a credit card to use cloudflare tunnels (though the proxy dies for an hour sometimes and I've read that happens on the free tier so maybe that's it?)

    • @apalrdsadventures
      @apalrdsadventures Před 11 dny

      With Orange Cloud, it will not actually add either record to 'real' DNS. 'Real' DNS will point both A and AAAA to Cloudflare's CDN (if you add either an A or AAAA), the record you 'add' just tells CF where the origin is.

  • @HappyfoxBiz
    @HappyfoxBiz Před 12 dny

    Windows: "you cannot use that command" user sweats: "please?" windows: "no!" Linux: "you made a mistake, you didn't use proper punctuation and capitalisation..." user: *checks homework and correctly retypes* Linux: "you cannot do that..." user: "I am root!" *casts a -f command* Linux: "OK!"

  • @elalemanpaisa
    @elalemanpaisa Před 12 dny

    By chance do you have a zero 2 ?

  • @DeVibe.
    @DeVibe. Před 12 dny

    Is it Chinese?

  • @rzvendramini
    @rzvendramini Před 12 dny

    I am currently operating behind a CGNAT, and I host my email service at home using MailinaBox. I have a Virtual Private Server (VPS) on Hostinger, which provides me with a public IPV4 address. I utilize a WireGuard tunnel in conjunction with iptables rules that extend all the way to my home, where I run a Virtual Machine (VM) within Proxmox that runs the MailinaBox setup. This system has been functioning exceptionally well for several months